T26 Security incident response plan
Security incident response plan
How Stonebridge Security and Norcastle Logistics respond together to a security incident, from the first alert to the lessons-learned review. This plan defines who does what, in what order, and what must never be skipped, such as evidence handling. Every person named below has agreed to their role.
Sample template: the firm, people, clients and figures are fictional and shown for illustration only.
Severity levels
| Severity | Definition | Example | Response target | Who is paged |
|---|---|---|---|---|
| SEV1, Critical | Active breach, data exfiltration, or ransomware encrypting production systems | Ransomware note found on the warehouse management server | 15 minutes | Renata Cole, Tom Brannigan, Norcastle CEO |
| SEV2, High | Confirmed unauthorized access, no confirmed data loss yet | Suspicious admin login from an unrecognized country | 1 hour | Renata Cole, Tom Brannigan |
| SEV3, Medium | Suspicious activity under investigation, not yet confirmed | Repeated failed logins against the driver portal | 4 hours | On-call Stonebridge analyst |
| SEV4, Low | Policy violation or low-risk finding, no active threat | Employee laptop found with disabled disk encryption | Next business day | Assigned analyst, logged only |
Response phases
flowchart LR
A[Detect] --> B[Triage and severity call]
B --> C[Contain]
C --> D[Eradicate]
D --> E[Recover]
E --> F[Lessons learned]
B --> G[Notify: client and legal]
G --> C
Containment starts before root cause is fully known. The goal in the first hour is to stop the incident from getting worse, not to explain it completely.
First hour checklist
Do not power off an affected system
Powering off a compromised machine destroys volatile memory that may hold the only evidence of how the attacker got in. Isolate it from the network instead, using port shutdown or firewall block, and leave it running until Stonebridge's forensic lead approves the next step. This applies even if the system is visibly encrypting files.
Chain of custody applies from the first action
Every device, log export or disk image touched during this response must be logged: who touched it, when, and why. Evidence without a clean chain of custody may be unusable if the incident results in legal or insurance action. Log entries go in the incident record, not in chat messages that can be edited or deleted.
Roles and responsibilities
Stonebridge's on-call security lead for SEV1 and SEV2 incidents, currently Renata Cole. Owns the severity call, coordinates all other roles, and is the single voice that speaks to Norcastle leadership during the incident. Decides when containment is complete enough to begin eradication.
Tom Brannigan, VP of IT at Norcastle Logistics. Authorizes any action that affects production systems, such as taking the warehouse management server offline. Approves the client-facing communication before it goes out. Is the escalation point to Norcastle's CEO for SEV1 incidents.
Stonebridge analyst assigned per incident from the on-call rotation. Owns evidence preservation, disk imaging and the technical root-cause timeline. No remediation step proceeds on an affected system until the forensic lead confirms evidence is preserved.
Norcastle's Head of Operations, currently Denise Kwan. Drafts and sends any communication to drivers, warehouse staff, or customers, using the approved templates below. Does not speculate on cause or scope beyond what the incident commander has confirmed.
Communication templates
Use these as a starting point only. The incident commander and client incident owner must approve any wording before it is sent, and facts must be confirmed, not assumed.
Internal staff holding notice, SEV1 or SEV2:
Subject: IT systems maintenance in progress
Team, we are investigating a technical issue affecting [system name].
As a precaution, please do not log into [system name] until further notice.
This is not a request to change your password or click any link.
Updates will follow from [communications lead name] every [interval].
Customer-facing notice, only after legal and the client incident owner approve:
Subject: Update on a technical issue affecting [system/service]
We identified a technical issue affecting [system/service] on [date].
We took immediate steps to contain it and are working with our security
partner to investigate. [Include only confirmed facts. Do not speculate
on cause, scope, or whether customer data was affected until confirmed.]
We will update you by [date/time].
Do not send the customer notice before legal review
Regulatory notification timelines depend on what is confirmed about data involved. Sending an unreviewed customer notice can create obligations or admissions the facts do not yet support. Route every external draft through Norcastle's legal counsel first, even under time pressure.
Lessons learned
After any SEV1 or SEV2 incident, Stonebridge runs a lessons-learned review within 10 business days.
The tabletop exercise in August found that our old plan never named who could actually authorize taking the warehouse system offline. Fixing that before a real incident, instead of during one, is the whole point of testing this plan.
Emergency contacts
- Stonebridge Security 24 by 7 hotline: on file in the signed engagement letter, not printed here.
- Renata Cole, Security Lead: primary incident commander.
- Tom Brannigan, VP of IT: client incident owner, primary escalation.
- Denise Kwan, Head of Operations: communications lead.
- Norcastle legal counsel: required approver for any external notification.
- Cyber insurance carrier claims line: required contact for any SEV1 incident, per the policy terms.
How to use this template
Duplicate this page once per client and keep it current as roles or systems change. Replace the values below; if a required value is missing, write Needs review rather than leaving the role unnamed.
| Variable | Meaning | Required |
|---|---|---|
{{client.name}} | Client this response plan covers | Required |
{{roles.incident_commander}} | Named person who owns severity calls during an incident | Required |
{{roles.client_incident_owner}} | Named client contact who authorizes production actions | Required |
{{roles.communications_lead}} | Named person who sends client and staff communications | Required |
{{severity.response_targets}} | Response time target for each severity level | Required |
{{plan.last_tested_date}} | Date of the most recent tabletop or real test | Optional |
Never list a hotline number, credential or private contact detail directly in a client-visible copy of this page; reference where it is stored instead.